Accept inbound email documents and rendered invoices into DataOps intake

[alexeygrigorev]

Context

The Zapier migration will send TODO emails, invoice attachments, and PDFs rendered from invoice-email bodies to DataOps. DataOps already has email/Telegram intake routes and S3-backed artifact concepts; this issue should extend those foundations with one machine-to-machine document intake contract.

Acceptance criteria

• Define one authenticated, versioned contract for email metadata plus private S3 file references.
• Support original email attachments and rendered-email PDF artifacts.
• Create or deduplicate intake using source Message-ID plus recipient route.
• Register documents as private/sensitive DataOps-owned artifacts with content type, size, and checksum.
• Link artifacts to the resulting intake item.
• Return distinct accepted, duplicate, validation-error, and partial-failure responses.
• Never persist signed URLs, tokens, raw secrets, or attachment bytes in DynamoDB.
• Document IAM or credential rotation and any cross-account S3 transfer.
• Test TODO email, attachment invoice, HTML invoice PDF, multiple attachments, duplicate delivery, and retry after partial failure.
• Reuse existing intake/artifact storage instead of adding a parallel document model.

Related work

Mailing-list exports remain tracked separately in #108. Cross-repository plan: dapier/docs/zapier-migration-plan.md.